Final Productization Report — DevPay (§15 capstone)
Reading guide
Historical productization assessment tied to a specific validated SHA. It combines feature statuses, security findings, and the next release entry conditions.
Do not confuse this retrospective with current PR readiness; consult the newer limitations register and CI evidence.
Evaluated at: validated base
9798ed8da870753c821b6a819fac3486a04825e6(merges p0 product-contract docs + p1 durable authority + p2 yp CLI + p3 seller ops console + p5 product CI). The p4 security/reliability battery landed concurrently and is unmerged at this SHA; its executed evidence is cited fromdocs/security/product-red-team.mdin the p4 worktree (c4e5b93c…, run 2026-11-04 vs baselinee3b4d04).This report is descriptive, not approving: PM owns the release decision. Every status is evidence-bound —
VERIFIEDclaims cite executed suites; unexecuted items are labeled, never inferred.
1. Readiness levels — definitions and current assessment
| Level | Meaning | Assessment |
|---|---|---|
EXPERIMENTAL_ONLY | Research PoC; loopback evidence only; no product surface | Where the pipeline started (auto-protection/secure-browser-licensing experiments) |
PRODUCT_CANDIDATE | Product-shaped surface with durable state, real authz enforcement, independently executed test evidence on the real stack (local), documented limits | CURRENT LEVEL — with caveats below |
BETA_READY | Candidate + staging-deployed feature set exercised by non-author users, real-PG test-mode roundtrip, backup/restore drill, legal sign-off, ops runbook | NOT MET — see beta-readiness-checklist.md §2 blockers B-1..B-8 |
PRODUCTION_READY | Beta + live payments authorized, SLA/alerting, load-tested at target volume, incident history | NOT MET — no production claims anywhere |
Caveats on PRODUCT_CANDIDATE: all backend evidence is loopback (wrangler dev --local + miniflare local D1, 127.0.0.1); the security plane is disabled in every real deployment (LICENSE_SECURITY_ENABLED absent from wrangler.toml → 404); hosted general-purpose execution is design-only.
2. What shipped in this wave (by task)
| Wave | Deliverable | Key commits | Status |
|---|---|---|---|
| p0 Product contract docs | docs/product/: product-scope, trust-model, product-contract, implementation-status, api-contract-map, pricing-metering-model | 6e608ec, 3ac0c78, 304d937 | SHIPPED — contract registry grounded in code, known limits recorded |
| p1 Durable authority | inbox_events dedup (015), usage_counters + consumed_by (016), reconciliation_runs/findings (017), outbox honest scope + OUTBOX_SINK_URL + admin redrive, tenant-scoped read APIs (bindings/usage/security-events/usage-counters) | 179b464, 931b69c | SHIPPED — 55-check durable E2E on real local D1 (tests/durable.test.mjs) |
p2 yp CLI | tools/devpay-cli/ — init/plan/review/apply/verify/doctor wrapping the auto-protection machinery; evidence-honesty fixes (vacuous verify refusal, PARTITION_AUTH pinning, plan→apply TOCTOU, env scrub, traversal, gitignore) | 0584131, a7fba8d | SHIPPED — 4 e2e tests in CI; local-only, no upload path |
| p3 Seller ops console | fe/pages/operations/index.vue — payment→entitlement linkage view, security events, refund anomalies, audit feed, report modal; license detail PoP bindings/usage; graceful degradation when durable APIs absent | 652fb6e, 61e0db5 | SHIPPED — seller-ops.spec.ts (3 specs) self-skips when the API lacks durable endpoints; executed only against the Worker path (CI e2e job runs Axum be/ → spec skips there, by design) |
| p4 Security + reliability battery | be-cloudflare/tests/red-team/ 12 legs + tests/reliability/ 7 legs + docs/security/product-red-team.md | unmerged at this SHA | EXECUTED — 11/12 BLOCKED + 1 PARTIAL (F-01); 7/7 BLOCKED; loopback only |
| p5 Product CI | .github/workflows/yetdapay.yml — product-suites (license-crypto, durable E2E, CLI e2e, 8 auto-protection suites) + security-regression (committed-artifact validation + conditional p4 step); wrangler/worker-build pinned, least-privilege permissions: | c76fd91, e506769 | SHIPPED — hard gates, no continue-on-error |
| p6 (this wave) | docs/product/: beta-readiness-checklist, data-protection-compliance, unit-economics-cost-model, hosted-execution-requirements, final-productization-report, known-limitations | this commit | DOCS ONLY — no code change, no new claims |
3. Per-feature status (12 core features, current)
| # | Feature | Status at 9798ed8 | Evidence |
|---|---|---|---|
| 1 | Protection Specification | EXISTING_AND_REUSABLE (PoC-grade) | spec suite in CI; draft→approved lifecycle via CLI gates; no persisted/signed approval |
| 2 | Protection Plan | EXISTING_AND_REUSABLE (PoC-grade) | planner suite in CI; sha-bound spec/target/driver (TOCTOU refused) |
| 3 | Track-A protection exec | EXISTING_AND_REUSABLE (PoC-grade) | analyzer/partitioner/track-a suites in CI; node:vm not a boundary — recorded |
| 4 | Track-B agent-native exec | EXISTING_AND_REUSABLE (PoC-grade) | track-b suite + CLI AGENT handoff bundles |
| 5 | License issuance & lifecycle | EXISTING_AND_REUSABLE | PAY-01/04/05 legs; lic_{ord_id} deterministic idempotency; seller-issued 32-bit keys = open finding |
| 6 | Entitlement protocol (hosted) | IMPLEMENTED, gated OFF in deployments | activate/capability/execute/status + durable counters; USE-01/02 legs; RT-SEC-01/02/08; LICENSE_SECURITY_ENABLED unset in wrangler.toml |
| 7 | BYOS enforcement SDK | EXISTING_AND_REUSABLE with interop deltas | @yetdapay/license-* 0.1.0; iss/activatePath defaults differ from Worker; no wire-version field |
| 8 | Durable usage | IMPLEMENTED (upgraded this wave) | license_usage + usage_counters atomic with consume (consumed_by winner guard); read APIs live |
| 9 | Payment sync | NEEDS_HARDENING → IMPLEMENTED (loopback, mock+TEST-stub) | inbox dedup, authority refetch, confirm_pending, needs_review; real PG sandbox BLOCKED_EXTERNAL_CREDENTIALS; outbox consumer optional |
| 10 | Refund & revocation | EXISTING_AND_REUSABLE | refund_attempts lifecycle + partial cap + compensation batch; REC-03 ordering leg |
| 11 | Independent verification & evidence | EXISTING_AND_REUSABLE + product-plane battery | p4 product red-team/reliability (19 legs executed); r18 47-leg artifacts validated in CI |
| 12 | Seller console + ops | PARTIALLY_IMPLEMENTED → PARTIALLY_IMPLEMENTED+ | ops page + license detail durable surfaces; buyer self-service still NOT_IMPLEMENTED; no spec/plan UI |
4. Open findings inventory
Consolidated residual findings across p0–p5 reviews + p4 battery. (Full detail: known-limitations.md.)
Medium
| ID | Finding | Source | State |
|---|---|---|---|
| M-1 | 32-bit seller-issued license keys enumerable via public un-rate-limited POST /licenses/verify (~4.3×10⁹ space) | product-contract.md KNOWN_LIMITATION | OPEN — accepted; migrate format or rate-limit |
| M-2 | Worker↔SDK contract interop: iss (devpay-lic vs yp), activatePath defaults, no aud/tenant_id/kid, no version field — external consumers break silently | p5-sdk-contract-audit.md, implementation-status #7 | OPEN — needs versioned-contract decision (B-6) |
| M-3 | No request-level rate limiting except /auth/login (5-fail→5-min lock). Webhook/license endpoints unthrottled | p4 F-05 (Info→tracked as cost/abuse risk) | OPEN — infrastructure work |
| M-4 | No D1 backup/restore path on the deployed stack (admin/backup is Axum-only) | beta-checklist item 6 | OPEN (B-5) |
Low / Info (p4 findings F-01..F-06 + prior residuals)
| ID | Finding | Severity | State |
|---|---|---|---|
| L-1 | F-01: location_hint.file not cross-checked against analysis.target — inert label, downstream must not trust | Low | OPEN |
| L-2 | F-02: dev identities get 401 (not scoped-200) on kind=="user"-gated lists — fail-closed parity gap, no exposure | Info | OPEN |
| L-3 | F-03: JWS typ not enforced (signature+claims still gate) | Info | OPEN (documented) |
| L-4 | F-04: multi-instance shared-D1 consume race loser surfaces 500 (dedup held exactly-1) | Info | OPEN — callers retry; D1-at-scale NOT_VERIFIED |
| L-5 | F-06: key rotation is hard cutover — in-flight entitlements die (120-s TTL bounds impact) | Info | OPEN (documented) |
| L-6 | Axum be/ has no PoP endpoint parity — local Axum dev cannot exercise security plane; seller-ops spec skips in CI e2e | Info | OPEN |
| L-7 | NODE_OPTIONS/NODE_* propagate into analyzed/traced driver child env (allowlist NODE_[A-Z_]+, analyzer/dynamic.mjs:33) — unlike partition workers where it's deliberately dropped | Low | OPEN |
| L-8 | CI actions tag-pinned (@v4, @stable) not SHA-pinned; Dependabot absent | Low | OPEN — noted inline in workflow |
| L-9 | experiment-h H-1 (Medium) / H-2 (Low) | — | FIXED + regression-tested (59/59) — kept for history |
| L-10 | usage/audit/retention housekeeping: retention_class/legal_hold schema-only; audit/security/usage/inbox/outbox rows never pruned | Info | OPEN |
Historical (pre-wave, still true)
node:vm/node:workernot a security boundary (trust-model §2.6).- BYOS enforcement removable by seller; DevPay cannot meter seller-internal executions (trust-model §2.1/2.2).
- Analog hole / cooperative-relay oracle bounds (trust-model §2.3/2.4).
- PoP contract is DevPay-specific, not RFC 9449 (§2.5).
5. Next-step entry conditions
To reach BETA_READY (restated from beta-readiness-checklist.md §3):
- Real PG test-mode roundtrip (purchase→webhook→refund) executed.
- Staging deployment with
LICENSE_SECURITY_ENABLED=true+ PoP suite against it. - D1 backup + restore drill executed.
- Wire-version/contract-pinning decision + interop re-verified.
- Legal sign-off (compliance doc §7/§8 items).
- Ops runbook + alerting +
needs_reviewresolution SLA. - One external seller pilot end-to-end.
Post-beta to PRODUCTION_READY: live-payment authorization (charter §0 requires explicit user approval), real outbox consumer, load test at target volume, rate-limit coverage, incident track record.
6. Honest summary
DevPay at this SHA is a product candidate with a working durable authority core: payments→license issuance is idempotent and reconciled; the PoP license protocol is implemented, device-bound, replay-resistant, and independently red-teamed on the real stack locally; the CLI drives the protection pipeline with hard honesty gates; the console surfaces durable truth to sellers. It is not beta: nothing has run against a real PG, a deployed security plane, an external user, or legal review — and the backup/restore and contract-versioning stories are absent.